Bug 2548460 (CVE-2026-79650)

Summary: CVE-2026-79650 org.apache.cxf/cxf-rt-rs-security-sso-oidc: Apache CXF: Open redirect via unvalidated state parameter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: csutherl, dsoumis, fmariani, gmalinko, janstey, jclere, jwon, mcarlett, pdelbell, pjindal, plodge, rmaucher, rstepani, szappis, tcunning, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache CXF's OpenID Connect (OIDC) relying-party component. This vulnerability allows a remote attacker to redirect authenticated users to arbitrary external websites by supplying manipulated state parameters. The issue occurs because the application preserves and reuses these parameters as redirect targets without verifying that the decoded destination matches the trusted origin, potentially exposing users to phishing attacks.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-09 10:31:45 UTC 
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.